SmartHawk

1.7

低危

64 个模型检测该样本为恶意！

重新分析

下载样本

dea04b79dbf0fa584e8e22c4a59a79aaa53e08ff59644fe7883119cf299d8687

dea04b79dbf0fa584e8e22c4a59a79aaa53e08ff59644fe7883119cf299d8687.exe

分析耗时

71s

最近分析

395天前

文件大小

6.1KB

静态报毒动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER UPATRE

DACN 0.14

FACILE 1.00

IMCLNet 0.51

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.04s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.51	Unknown	0.15s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanDownloader:Win32/Upatre.1fa57e8a	20190527	0.3.0.5
Avast	Win32:Trojan-gen	20200717	18.4.3895.0
Baidu	None	20190318	1.0.0.2
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Kingsoft	None	20200717	2013.8.14.323
McAfee	GenericRXAA-FA!D4E0B0791DE3	20200717	6.0.6.653
Tencent	Malware.Win32.Gencirc.10b0cca2	20200717	1.0.0.1

在文件系统上创建可执行文件 (1 个事件)

file	C:\Users\Administrator\AppData\Local\Temp\denis.exe

投放一个二进制文件并执行它 (1 个事件)

file	C:\Users\Administrator\AppData\Local\Temp\denis.exe

将可执行文件投放到用户的 AppData 文件夹 (1 个事件)

file	C:\Users\Administrator\AppData\Local\Temp\denis.exe

一个进程创建了一个隐藏窗口 (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1727110794.812125 ShellExecuteExW	filepath: C:\Users\Administrator\AppData\Local\Temp\denis.exe filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\denis.exe parameters: show_type: 0	success	1	0

与未执行 DNS 查询的主机进行通信 (1 个事件)

host

114.114.114.114

文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意 (50 out of 64 个事件)

ALYac	Trojan.Ppatre.Gen.1
APEX	Malicious
AVG	Win32:Trojan-gen
Acronis	suspicious
Ad-Aware	Trojan.Ppatre.Gen.1
AhnLab-V3	Trojan/Win32.Upatre.R333926
Alibaba	TrojanDownloader:Win32/Upatre.1fa57e8a
Antiy-AVL	Trojan[Downloader]/Win32.Waski
Arcabit	Trojan.Ppatre.Gen.1
Avast	Win32:Trojan-gen
Avira	HEUR/AGEN.1102638
BitDefender	Trojan.Ppatre.Gen.1
BitDefenderTheta	AI:Packer.DAB062891F
Bkav	W32.AIDetectVM.malware1
CAT-QuickHeal	Trojan.GenericRI.S7518593
ClamAV	Win.Dropper.Upatre-7465221-0
Comodo	TrojWare.Win32.TrojanDownloader.Waski.ADW@8mzp93
CrowdStrike	win/malicious_confidence_100% (W)
Cybereason	malicious.91de33
Cylance	Unsafe
Cynet	Malicious (score: 100)
Cyren	W32/S-47db96bb!Eldorado
DrWeb	Trojan.DownLoad3.33216
ESET-NOD32	Win32/TrojanDownloader.Waski.E
Emsisoft	Trojan.Ppatre.Gen.1 (B)
Endgame	malicious (high confidence)
F-Prot	W32/S-47db96bb!Eldorado
F-Secure	Heuristic.HEUR/AGEN.1102638
FireEye	Generic.mg.d4e0b0791de330cd
Fortinet	W32/EncPk.ACO!tr
GData	Trojan.Ppatre.Gen.1
Ikarus	Trojan-Downloader.Win32.Upatre
Invincea	heuristic
Jiangmin	TrojanSpy.Zbot.ffhh
K7AntiVirus	Trojan-Downloader ( 0055f33b1 )
K7GW	Trojan-Downloader ( 0055f33b1 )
Kaspersky	HEUR:Trojan.Win32.Tremp.gen
Lionic	Trojan.Win32.Generic.lY5V
MAX	malware (ai score=100)
McAfee	GenericRXAA-FA!D4E0B0791DE3
MicroWorld-eScan	Trojan.Ppatre.Gen.1
Microsoft	TrojanDownloader:Win32/Upatre.AA
NANO-Antivirus	Trojan.Win32.DownLoad3.gaapvu
Paloalto	generic.ml
Panda	Trj/Genetic.gen
Qihoo-360	Win32/Trojan.Downloader.Small.I
Rising	Downloader.Upatre!8.B5 (TFE:3:JrFJf4jCRlD)
SUPERAntiSpyware	Trojan.Agent/Gen-Upatre
Sangfor	Malware
SentinelOne	DFI - Malicious PE

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2014-05-13 14:44:14

PE Imphash

b1decad0f067131fff2e76ab43787f60

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
.text	0x00001000	0x000004b4	0x00000600	4.999465465442318
.rdata	0x00002000	0x000004c0	0x00000600	4.100155344492721
.data	0x00003000	0x00000020	0x00000200	0.0
.rsrc	0x00004000	0x000001c0	0x00000200	0.0
.reloc	0x00005000	0x000000d0	0x00000200	0.0

Imports

Library WININET.dll:

• 0x402064 HttpOpenRequestW

• 0x402068 InternetConnectW

• 0x40206c HttpSendRequestW

• 0x402070 InternetReadFile

• 0x402074 InternetCloseHandle

• 0x402078 InternetOpenW

Library KERNEL32.dll:

• 0x402000 ReadFile

• 0x402004 SleepEx

• 0x402008 GetCurrentDirectoryW

• 0x40200c HeapFree

• 0x402010 FreeLibrary

• 0x402014 GetProcAddress

• 0x402018 GetModuleHandleW

• 0x40201c HeapCreate

• 0x402020 HeapAlloc

• 0x402024 GetModuleFileNameW

• 0x402028 GetTempPathW

• 0x40202c CreateFileW

• 0x402030 GetFileSize

• 0x402034 lstrlenW

• 0x402038 ExitProcess

• 0x40203c DeleteFileW

• 0x402040 lstrcmpW

• 0x402044 WriteFile

• 0x402048 CloseHandle

• 0x40204c LoadLibraryW

Library USER32.dll:

• 0x40205c wsprintfW

Library SHELL32.dll:

• 0x402054 ShellExecuteW

L!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
SUV3WVt$
PD$0Sj
t$,SWV
_^3]@[4
VD$,Pt$
\VD$,PW
VWVUhX!@
VCC<t$
tVVVVhd!@
D$4|!@
t$<t$ t$
D$<PD$
|[3VVVVS
D$(PUS
D$(PUWt$ 
|$,;Mu
@;rh!@
SUt$(t$@h
VD$DPt$4t$$W
Vt$,SVt$,
UD$HPh!@
VVVD$PP
up_uo5uu
u7*u w)uRu]
uG]u7u*ukeu
TvSvSv~SvTv
RtlDecompressBuffer
InternetOpenW
InternetCloseHandle
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetReadFile
WININET.dll
GetModuleHandleW
HeapCreate
HeapAlloc
GetModuleFileNameW
GetTempPathW
CreateFileW
GetFileSize
lstrlenW
ExitProcess
ReadFile
lstrcmpW
WriteFile
CloseHandle
DeleteFileW
SleepEx
LoadLibraryW
GetProcAddress
FreeLibrary
HeapFree
GetCurrentDirectoryW
KERNEL32.dll
wsprintfW
USER32.dll
ShellExecuteW
SHELL32.dll
/css/1305UKdw.zip
/images/powerslide/Concha/1305UKdw.zip
paulaggg.com
luxesydiseno.com
denis.exe
CheckUpdate
text/*
application/*
ntdll.dll
rsengo.exe
C:\c1b6857536e61e3c52ac99221b611ff4fba682c21c458405b8fa11d9081f5da0
C:\Documents and Settings\Administrator\Desktop\2B9uxBW2.exe
C:\664b1a93ddb37fad3dd5f5de77591dc0055988c1d0ba295951bdde7157d6f364
C:\Users\Petra\AppData\Local\Temp\denis.pe32
C:\1ece8ab23ea5d666d8d1752e366fd3e713b8d0a37ff676b8e1b6886ef105f26a

Process Tree

dea04b79dbf0fa584e8e22c4a59a79aaa53e08ff59644fe7883119cf299d8687.exe (1808) "C:\Users\Administrator\AppData\Local\Temp\dea04b79dbf0fa584e8e22c4a59a79aaa53e08ff59644fe7883119cf299d8687.exe"
- denis.exe (2336) "C:\Users\ADMINI~1\AppData\Local\Temp\denis.exe"

dea04b79dbf0fa584e8e22c4a59a79aaa53e08ff59644fe7883119cf299d8687.exe, PID: 1808, Parent PID: 2200

default registry file network process services synchronisation iexplore office pdf

denis.exe, PID: 2336, Parent PID: 1808

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	56933	114.114.114.114	53
192.168.56.101	138	192.168.56.255	138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	4f342d68f9f6f758_denis.exe
Filepath	C:\Users\Administrator\AppData\Local\Temp\denis.exe
Size	6.3KB
Processes	1808 (dea04b79dbf0fa584e8e22c4a59a79aaa53e08ff59644fe7883119cf299d8687.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`800c12ff515ea3fd37445155573d59e1`
SHA1	`9992a76064eca8d273d996b23bd884579c146a1f`
SHA256	`4f342d68f9f6f758d77d0a2de0dafa84b97ee625f82e0289fc346fbe13af7b11`
CRC32	`7F3703F1`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.